Security Engineering on AWS

Syllabus – Key points

• Welcome and introductions
• Introduction to Security on AWS

Identifying entry points on AWS

• Ways to access the platform
• IAM policies
• Securing entry points
• Incident response

Lab – cross-account authentication

Security Considerations – Web Applications

• Security points in an AWS web application environment
• Analyse a three-tier application model and identify common threats
• Assess environments to improve security

Application Security

• Securing EC2 instances
• Assess vulnerabilities with Inspector
• Apply security in an automated way using Systems Manager
• Isolate a compromised instance

Lab – Assessing Security with Inspector and Systems Manager

Securing Networking Communications – Part 1

• Apply security best practices to VPC
• Implement an ELB device as a protection point
• Protect data in transit using certificates

Data Security

• Protect data at rest using encryption and access controls
• AWS services used to replicate data
• Protect archived data

Security Considerations: Hybrid Environments

• Security points outside of a VPC
• Common DoS threats

Monitoring and Collecting Logs on AWS

• Monitor events and collect logs with CloudWatch
• Use Config to monitor resources
• AWS-native services that generate and collect logs

Lab – Server Log Analysis Part 1 – collect logs

Processing Logs on AWS

• Stream and process logs for further analysis
• AWS services used to process logs from S3 buckets

Lab – Server Log Analysis Part 2 – analyse logs

Securing Networking Communications – Part 2

• Identify AWS services used to connect on-premise to AWS
• Data protection between on-premise and AWS
• Securely access VPC resources in other accounts

Out-Of-Region Protection

• Use Route 53 to isolate attacks
• Implement WAF to protect applications
• Use CloudFront to deliver content securely
• Protect applications using Shield

Account Management on AWS

• Manage multiple accounts
• Use identity providers / brokers to acquire access to AWS services

Lab – AWS Federated Authentication with ADFS

Security Considerations: Serverless Environments

• How to secure data in a serverless environment
• Use Cognito to authorize users
• Control API access with API Gateway
• Use AWS messaging services securely
• Secure Lambda functions

Lab – Monitor and Respond with Config and Lambda

Secrets Management on AWS

• Manage key and data encryption with KMS
• Describe how CloudHSM is used to generate and secure keys
• Use Secrets Manager to authenticate applications

Lab – Using KMS

Security Automation on AWS

• Deploy security-oriented AWS environments in a reproducible manner
• Provide management and control of IT services to end-users in a self-serve manner

Lab – Security Automation on AWS with Service Catalog

Threat Detection and Sensitive Data Monitoring

• Threat detection and monitoring for malicious or unauthorized behaviour
• Leverage machine learning to gain visibility into how sensitive data is being managed in the AWS Cloud